How to Allow Non-Admin Users to Start/Stop Windows Service

By default, common (non-admin) users cannot manage Windows services. It means that they cannot stop, start or change the settings or permissions for system services. In some cases, it is necessary for a user to have the permissions to restart or manage certain services. In this article we’ll look at several ways to manage the permissions for Windows services. In particular, we’ll show you how to allow a common user (without admin rights) to start and stop a specific Windows service by granting the appropriate permissions.

Suppose, you need to allow the domain account contoso\tuser the permissions to restart Print Spooler service (service name – spooler).

There is no simple and convenient built-in tool to manage services permissions in Windows. We’ll consider some ways to grant the permissions to a user to manage service:

Built-in SC.exe (Service controller) utility

A standard built-in Windows method to manage system service permissions supposes using the sc.exe (Service Controller) utility. The main problem with using this utility is the complex syntax of the format for granting permissions for a service (SDDL format).

Setting Service Permissions Using SubInACL Tool

It is easier to use a command line tool SubInACL from the Sysinternals by Mark Russinovich. The syntax of this tool is much easier and more convenient. Here is how you can grant the restart permissions for a service using SubInACL:

Note. In this case we have granted a user the permissions to suspend (pause/continue), start and stop a service. The full list of the available permissions:F : Full Control R : Generic Read W : Generic Write X : Generic eXecute L : Read controL Q : Query Service Configuration S : Query Service Status E : Enumerate Dependent Services C : Service Change Configuration T : Start Service O : Stop Service P : Pause/Continue Service I : Interrogate Service U : Service User-Defined Control Commands

If you need to grant permissions to a service running on a remote machine, the syntax is as follows:subinacl /SERVICE \\lon-prnt1\spooler /grant=contoso\tuser=F

Now you only have to log on with the user account and try to restart the service with these commands:net stop spoolernet start spooler

If you did everything right, the service should stop and start again.

Set Windows Service Permission Using Process Explorer

You can change Windows service permissions using one more Sysinternals utility – Process Explorer. Run Process Explorer as administrator and find the process of the service you need. In our example, this is spoolsv.exe (the spooler executable – C:\Windows\System32\spoolsv.exe). Open the process properties and click the Services tab.

Click the Permissions button and add the user or group in the window that opens. After that select the permissions that you want to assign.

Security Template

A visual (but requiring more actions) graphical way to manage service permissions is using Security Templates. Open mmc.exe console and add the Security Templates snap-in.

Create a new template (New Template).

Specify the name for the new template and go to the System Services section. In the list of services select your service Print Spooler and open its properties.

Select the startup mode (Automatic) and click Edit Security.

Using the Add button, add a user account or a group to grant permissions to. In our case, Start, stop and pause permission is enough.

Save this template.

Note. The content of the Security Template is saved as the INF file in the C:\Users\%username%\Documents\Security\Templates folder

If you open this file, you can see that the information about the permissions is saved in the SDDL format, mentioned earlier. The string obtained in this way can be used as an argument of the sc.exe command.

Now you only have to create a new database (Open Database) using the Security Configuration and Analysis snap-in and import your Security Template from Spooler User Rights.inf.

Apply this template by selecting Configure Computer Now command from the context menu.

Now you check that the user has the rights to manage the Print Spooler service.

Service Permissions Management Using GPO

If you have to grant permissions to users to start/stop a service on a number of computers, it’s easier to use Group Policy (GPO) features:

Create a new GPO or edit the existing one, link it to the necessary container (OU) with the computers in Active Directory. Go to Computer configuration -> Windows Settings -> Security Settings -> System Services;

Find the Spooler service and grant permissions to the users like in the method described above. Save the changes;

Wait until the GPO is applied on client computers and make sure that the service permissions have been assigned.

Using PowerShell to Assign Service Permissions

In TechNet gallery there is a separate unofficial PowerShell module for managing permissions for different Windows objects – PowerShellAccessControl Module (you can download it here). This module also allows to manage the service permissions. Install this module and import it into your session:

Import-Module PowerShellAccessControl

You can obtain effective permissions for a specific service like this:

Get-Service spooler | Get-EffectiveAccess -Principal corp\tuser

To allow non-admin user to start and stop spooler service, run the command: